XP internet security 2012 infection [Solved]

Hello, I got infected with XP internet security 2012. The infection seems to only affect one profile (Thunder), I think I got it by clicking on a link to listen to audio (www.seneweb.com) at the time, the profile used Thunder was unfortunately set as admin. I'm using the same computer but logged as sr71 (admin) to make this post. If I'm logged as Thunder, my firewall is turned off as well as my antivirus (Microsoft security essentials) an I can't surf with Firefox, i get a message saying that there is a security threat. I ran OTL version 3.2.22.3. Please find the log below.

Thanks
================================================================================
========================
OTL logfile created on: 1/3/2012 10:29:43 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\SR71 Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 68.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): E:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.24 Gb Total Space | 2.68 Gb Free Space | 7.19% Space Free | Partition Type: NTFS
Drive E: | 76.33 Gb Total Space | 25.80 Gb Free Space | 33.81% Space Free | Partition Type: NTFS

Computer Name: DELL-450 | User Name: SR71 Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/12/31 12:40:40 | 000,924,632 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/06/15 14:16:48 | 000,997,920 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/04/27 14:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2011/03/12 14:07:27 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\SR71 Administrator\Desktop\OTL.exe
PRC - [2010/11/05 19:31:55 | 000,491,168 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Real\RealPlayer\realplay.exe
PRC - [2010/11/05 19:31:53 | 000,274,608 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2008/12/18 10:47:08 | 009,158,656 | —- | M] (Microsoft Corporation) – E:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/04/09 11:32:32 | 000,019,456 | —- | M] (Creative Technology Ltd) – C:\WINDOWS\system32\CtHelper.exe


========== Modules (SafeList) ==========

MOD - [2011/04/18 21:51:18 | 000,653,136 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43\msvcr90.dll
MOD - [2011/04/18 21:51:18 | 000,569,680 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43\msvcp90.dll
MOD - [2011/03/12 14:07:27 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\SR71 Administrator\Desktop\OTL.exe
MOD - [2010/11/05 19:32:13 | 000,040,448 | —- | M] (RealNetworks, Inc.) – C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
MOD - [2010/08/23 11:12:02 | 001,054,208 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2007/04/09 11:32:30 | 000,008,704 | —- | M] (Creative Technology Ltd) – C:\WINDOWS\system32\ctagent.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] – – (IDriverT)
SRV - [2011/06/12 10:15:00 | 031,125,880 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Microsoft Office\Office14\GROOVE.EXE – (Microsoft SharePoint Workspace Audit Service)
SRV - [2011/04/27 14:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe – (MsMpSvc)
SRV - [2008/12/18 10:47:08 | 009,158,656 | —- | M] (Microsoft Corporation) [Auto | Running] – E:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe – (MSSQL$PINNACLESYS)
SRV - [2007/02/25 21:55:18 | 000,125,048 | —- | M] (TOSHIBA CORPORATION) [Disabled | Stopped] – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe – (TOSHIBA Bluetooth Service)
SRV - [2006/01/19 09:22:20 | 000,049,152 | —- | M] (Pinnacle Systems) [Disabled | Stopped] – E:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe – (PinnacleSys.MediaServer)
SRV - [2005/05/03 21:42:56 | 000,323,584 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – E:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE – (SQLAgent$PINNACLESYS)
SRV - [2001/08/09 01:01:00 | 000,090,112 | —- | M] (SEIKO EPSON CORPORATION) [Disabled | Stopped] – C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe – (EPSONStatusAgent2)


========== Driver Services (SafeList) ==========

DRV - [2012/01/03 22:13:54 | 000,029,904 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F8738402-A67E-4416-A5E3-2695BFD830BC}\MpKsl7fa50301.sys – (MpKsl7fa50301)
DRV - [2011/07/20 02:45:52 | 000,136,808 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ssadmdm.sys – (ssadmdm)
DRV - [2011/07/20 02:45:52 | 000,121,064 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ssadbus.sys – (ssadbus) SAMSUNG Android USB Composite Device driver (WDM)
DRV - [2011/07/20 02:45:52 | 000,012,776 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ssadmdfl.sys – (ssadmdfl) SAMSUNG Android USB Modem (Filter)
DRV - [2010/01/26 21:09:02 | 000,050,704 | —- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\npf.sys – (npf)
DRV - [2009/06/10 10:23:04 | 000,036,992 | —- | M] (Saitek) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SaiBus.sys – (SaiNtBus)
DRV - [2009/06/10 10:23:04 | 000,014,080 | —- | M] (Saitek) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SaiMini.sys – (SaiMini)
DRV - [2009/03/18 16:35:40 | 000,026,176 | -H– | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hamachi.sys – (hamachi)
DRV - [2008/04/13 13:36:41 | 000,063,744 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\mf.sys – (mf)
DRV - [2007/06/11 14:25:28 | 000,041,856 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\tosrfusb.sys – (Tosrfusb)
DRV - [2007/05/24 14:27:30 | 000,064,000 | —- | M] (TOSHIBA Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\tosrfcom.sys – (Tosrfcom)
DRV - [2007/05/01 15:11:28 | 000,132,232 | —- | M] (Saitek) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SaiH0255.sys – (SaiH0255)
DRV - [2007/05/01 14:34:56 | 000,132,232 | —- | M] (Saitek) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SaiHFF12.sys – (SaiHFF12)
DRV - [2007/05/01 14:34:56 | 000,016,256 | —- | M] (Saitek) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SaiIFF12.sys – (SaiIFF12) Immersion's HID USB Driver (FF12)
DRV - [2007/04/24 13:20:06 | 000,113,920 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\tosrfbd.sys – (Tosrfbd)
DRV - [2007/04/18 07:59:40 | 000,098,600 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\COMMONFX.DLL – (COMMONFX.DLL)
DRV - [2007/04/12 07:10:26 | 000,164,608 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\CT20XUT.DLL – (CT20XUT.DLL)
DRV - [2007/04/12 07:10:26 | 000,066,816 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\CTHWIUT.DLL – (CTHWIUT.DLL)
DRV - [2007/04/12 07:10:24 | 001,317,632 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\CTEXFIFX.DLL – (CTEXFIFX.DLL)
DRV - [2007/04/12 07:10:22 | 000,323,328 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\CTEDSPSY.DLL – (CTEDSPSY.DLL)
DRV - [2007/04/12 07:10:22 | 000,128,768 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\CTEDSPIO.DLL – (CTEDSPIO.DLL)
DRV - [2007/04/12 07:10:20 | 000,280,320 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\CTEDSPFX.DLL – (CTEDSPFX.DLL)
DRV - [2007/04/12 07:10:20 | 000,094,976 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\CTERFXFX.DLL – (CTERFXFX.DLL)
DRV - [2007/04/12 07:10:18 | 000,168,192 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\CTEAPSFX.DLL – (CTEAPSFX.DLL)
DRV - [2007/04/12 07:10:16 | 000,560,384 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\CTSBLFX.DLL – (CTSBLFX.DLL)
DRV - [2007/04/12 07:10:16 | 000,546,048 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\CTAUDFX.DLL – (CTAUDFX.DLL)
DRV - [2007/04/10 05:00:24 | 000,157,480 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ctsfm2k.sys – (ctsfm2k)
DRV - [2007/04/10 04:59:04 | 000,126,760 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ctoss2k.sys – (ossrv)
DRV - [2007/04/10 03:32:06 | 000,189,736 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\haP17v2k.sys – (hap17v2k)
DRV - [2007/04/10 03:31:18 | 000,163,112 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\haP16v2k.sys – (hap16v2k)
DRV - [2007/04/10 03:29:10 | 000,797,992 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ha10kx2k.sys – (ha10kx2k)
DRV - [2007/04/10 03:28:36 | 000,092,968 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\emupia2k.sys – (emupia)
DRV - [2007/04/10 03:25:46 | 000,014,632 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ctprxy2k.sys – (ctprxy2k)
DRV - [2007/04/10 03:21:06 | 000,347,128 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ctdvda2k.sys – (ctdvda2k)
DRV - [2007/04/10 03:20:38 | 000,520,488 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ctaud2k.sys – (ctaud2k) Creative Audio Driver (WDM)
DRV - [2007/04/10 03:19:30 | 000,511,272 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ctac32k.sys – (ctac32k)
DRV - [2007/03/01 16:53:10 | 000,073,728 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Tosrfhid.sys – (Tosrfhid)
DRV - [2007/01/22 10:43:26 | 000,053,376 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\TosRfSnd.sys – (TosRfSnd)
DRV - [2006/11/20 17:55:16 | 000,036,480 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\tosrfbnp.sys – (Tosrfbnp)
DRV - [2006/10/10 19:33:00 | 000,041,600 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tosporte.sys – (tosporte)
DRV - [2005/06/02 19:28:38 | 000,171,008 | —- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\MarvinBus.sys – (MarvinBus)
DRV - [2005/02/23 17:40:26 | 000,011,264 | —- | M] (VOB Computersysteme GmbH) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\asapiW2k.sys – (ASAPIW2K)
DRV - [2005/01/06 13:42:42 | 000,018,612 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\tosrfnds.sys – (tosrfnds)
DRV - [2003/08/18 15:33:48 | 000,014,564 | —- | M] (Pinnacle Systems GmbH) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\PCLEPCI.sys – (PCLEPCI)
DRV - [2003/08/08 03:01:00 | 000,004,256 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\userport.sys – (UserPort)
DRV - [2002/10/16 13:55:48 | 000,002,851 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Toshidpt.sys – (toshidpt)
DRV - [2001/08/17 13:12:22 | 000,010,368 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrUsbScn.sys – (BrUsbScn)
DRV - [2001/08/17 13:12:12 | 000,002,944 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrFilt.sys – (brfilt)
DRV - [2001/08/17 12:12:24 | 000,003,168 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrParImg.sys – (brparimg)
DRV - [2001/08/17 12:12:18 | 000,039,552 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrParwdm.sys – (BrParWdm)
DRV - [1999/09/10 12:06:00 | 000,025,244 | —- | M] (Adaptec) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\ASPI32.SYS – (ASPI32)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 56 A9 04 00 D9 27 CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "file:///C:/Documents%20and%20Settings/Thunder/Desktop/bookmarks.html"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=937811&p="

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/11/05 19:32:14 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/31 12:40:41 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/07/14 16:39:04 | 000,000,000 | —D | M]

[2011/03/12 16:46:01 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\SR71 Administrator\Application Data\Mozilla\Extensions
[2011/03/13 17:29:52 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\SR71 Administrator\Application Data\Mozilla\Firefox\Profiles\nd5di18u.default\extensions
[2011/03/12 17:49:14 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\SR71 Administrator\Application Data\Mozilla\Firefox\Profiles\nd5di18u.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/11/27 15:19:01 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) –
[2011/12/31 12:40:41 | 000,121,816 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011/04/14 04:08:00 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2011/12/31 12:40:35 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2011/12/31 12:40:35 | 000,002,040 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2004/08/04 05:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CtHelper.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTxfiHlp] C:\WINDOWS\System32\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [SystemTray] C:\WINDOWS\System32\systray.exe (Microsoft Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Reg Error: Value error. File not found
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase6770.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1246220607619 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\SR71 Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\SR71 Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/12/11 17:57:39 | 000,000,095 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2099/01/01 12:00:00 | 000,000,000 | -HSD | C] – C:\WINDOWS\xxclone.arc
[2011/12/07 21:06:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Earth
[2011/01/24 20:37:42 | 009,777,448 | —- | C] (Apple Inc.) – C:\Program Files\iTunes.exe
[2007/04/09 11:32:58 | 000,034,816 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[2007/04/09 11:19:16 | 000,010,240 | —- | C] ( ) – C:\WINDOWS\System32\killapps.exe

========== Files - Modified Within 30 Days ==========

[2012/01/03 22:26:41 | 000,004,598 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2012/01/03 22:26:29 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/01/03 22:26:29 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/03 22:26:29 | 000,000,304 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1844237615-1409082233-725345543-1005.job
[2012/01/03 22:26:27 | 000,000,282 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1844237615-1409082233-725345543-1003.job
[2012/01/03 22:18:55 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012/01/03 22:15:18 | 000,012,792 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\swc76gb71ft3cdlljdni487257m6wkj833g12yqitg7
[2012/01/03 22:13:03 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/01/03 22:13:02 | 1609,637,888 | -HS- | M] () – C:\hiberfil.sys
[2012/01/03 22:12:19 | 000,030,912 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000005-00000000-0000000D-00001102-00000004-10031102}.rfx
[2012/01/03 22:12:19 | 000,030,912 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000005-00000000-0000000D-00001102-00000004-10031102}.rfx
[2012/01/03 22:12:19 | 000,030,120 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000005-00000000-0000000D-00001102-00000004-10031102}.rfx
[2012/01/03 22:12:19 | 000,030,120 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000005-00000000-0000000D-00001102-00000004-10031102}.rfx
[2012/01/03 22:12:19 | 000,011,564 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000005-00000000-0000000D-00001102-00000004-10031102}.rfx
[2012/01/03 22:06:00 | 000,000,888 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/03 21:52:00 | 000,000,986 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-1409082233-725345543-1003UA.job
[2012/01/03 20:52:00 | 000,000,934 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-1409082233-725345543-1003Core.job
[2012/01/03 15:48:35 | 000,000,312 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1844237615-1409082233-725345543-1005.job
[2012/01/03 14:25:16 | 000,000,038 | —- | M] () – C:\WINDOWS\BMUpdate.ini
[2012/01/03 14:22:13 | 000,000,290 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1844237615-1409082233-725345543-1003.job
[2012/01/03 10:02:05 | 000,002,265 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2011/12/23 00:17:12 | 000,005,632 | —- | M] () – C:\Documents and Settings\SR71 Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/22 19:36:59 | 000,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/12/17 12:14:09 | 000,001,813 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2011/12/15 13:08:27 | 000,325,912 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/15 11:14:53 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/12/09 23:06:54 | 000,000,212 | -HS- | M] () – C:\boot.ini
[2011/12/07 21:06:07 | 000,001,915 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2011/12/06 12:45:05 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

========== Files Created - No Company Name ==========

[2012/01/03 14:21:58 | 000,012,792 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\swc76gb71ft3cdlljdni487257m6wkj833g12yqitg7
[2011/11/02 20:17:17 | 000,000,068 | —- | C] () – C:\WINDOWS\ASAPrep.ini
[2011/08/08 19:57:21 | 000,000,000 | —- | C] () – C:\WINDOWS\PanelExe.INI
[2011/08/08 19:57:21 | 000,000,000 | —- | C] () – C:\WINDOWS\EngineExe.INI
[2011/07/26 16:26:46 | 000,974,848 | —- | C] () – C:\WINDOWS\System32\cis-2.4.dll
[2011/07/26 16:26:46 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2011/07/26 16:26:46 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2011/07/26 16:26:46 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\issacapi_se-2.3.dll
[2011/03/24 14:21:14 | 000,444,283 | —- | C] () – C:\Program Files\Common Files\WinPcapNmap.exe
[2011/03/12 17:54:12 | 000,005,632 | —- | C] () – C:\Documents and Settings\SR71 Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/03 00:27:00 | 000,000,776 | —- | C] () – C:\WINDOWS\xxclone.ini
[2010/12/12 23:27:34 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/12/11 20:18:28 | 000,000,017 | —- | C] () – C:\WINDOWS\MovingPicture.ini
[2010/12/11 18:16:01 | 000,194,248 | —- | C] () – C:\WINDOWS\System32\LTRFD13n.DLL
[2010/12/11 17:57:39 | 000,001,208 | —- | C] () – C:\WINDOWS\VFO.INI
[2010/12/11 17:57:38 | 000,196,096 | —- | C] () – C:\WINDOWS\System32\macd32.dll
[2010/12/11 17:57:38 | 000,138,752 | —- | C] () – C:\WINDOWS\System32\mase32.dll
[2010/12/11 17:57:38 | 000,136,192 | —- | C] () – C:\WINDOWS\System32\mamc32.dll
[2010/12/11 17:57:38 | 000,057,856 | —- | C] () – C:\WINDOWS\System32\masd32.dll
[2010/12/11 17:57:38 | 000,027,648 | —- | C] () – C:\WINDOWS\System32\ma32.dll
[2010/09/19 16:11:47 | 000,000,084 | —- | C] () – C:\WINDOWS\opt_2460.ini
[2010/09/19 16:11:47 | 000,000,050 | —- | C] () – C:\WINDOWS\brmx2001.ini
[2010/09/19 16:08:54 | 000,002,652 | —- | C] () – C:\WINDOWS\BrmfBidi.ini
[2010/09/19 16:07:07 | 000,000,871 | —- | C] () – C:\WINDOWS\Brpcfx.ini
[2010/09/19 16:07:03 | 000,000,052 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2010/09/19 16:06:51 | 000,651,264 | —- | C] () – C:\WINDOWS\System32\brfxdial.dll
[2010/09/19 11:07:09 | 000,000,038 | —- | C] () – C:\WINDOWS\BMUpdate.ini
[2010/09/05 14:10:59 | 000,000,261 | —- | C] () – C:\WINDOWS\SMSI.INI
[2010/09/05 14:10:38 | 000,000,410 | —- | C] () – C:\WINDOWS\brwmark.ini
[2010/09/05 14:10:38 | 000,000,173 | —- | C] () – C:\WINDOWS\brqikmon.ini
[2010/09/05 14:08:18 | 000,002,588 | —- | C] () – C:\WINDOWS\maxlink.ini
[2010/09/05 14:08:18 | 000,000,091 | —- | C] () – C:\WINDOWS\calera.ini
[2010/09/05 14:08:14 | 000,269,312 | —- | C] () – C:\WINDOWS\System32\FPXIG.DLL
[2010/09/05 14:08:14 | 000,068,096 | —- | C] () – C:\WINDOWS\System32\IGFPX32P.DLL
[2010/09/05 14:08:14 | 000,065,024 | —- | C] () – C:\WINDOWS\System32\JPEGACC.DLL
[2010/09/05 14:08:04 | 000,101,376 | —- | C] () – C:\WINDOWS\System32\WELSOF32.DLL
[2010/09/05 14:07:08 | 000,000,038 | —- | C] () – C:\WINDOWS\VISSETUP.INI
[2010/08/24 11:59:51 | 002,513,520 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/08/18 22:01:01 | 000,140,624 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010/08/18 22:00:21 | 000,266,752 | —- | C] () – C:\WINDOWS\System32\PnkBstrB.exe
[2010/08/18 21:58:21 | 000,075,136 | —- | C] () – C:\WINDOWS\System32\PnkBstrA.exe
[2010/08/09 21:39:41 | 000,000,032 | —- | C] () – C:\WINDOWS\vb_mconf.ini
[2010/01/31 16:37:48 | 000,000,256 | —- | C] () – C:\WINDOWS\System32\brmsl01.bin
[2010/01/26 21:09:02 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2009/12/27 15:38:13 | 000,044,544 | —- | C] () – C:\WINDOWS\System32\GIF89.DLL
[2009/12/27 15:38:10 | 000,484,352 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2009/12/14 21:09:33 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2009/11/16 16:48:57 | 000,000,615 | —- | C] () – C:\WINDOWS\eReg.dat
[2009/11/14 16:46:17 | 000,000,100 | —- | C] () – C:\WINDOWS\WirelessFTP.INI
[2009/11/14 14:39:32 | 000,000,000 | —- | C] () – C:\WINDOWS\tosOBEX.INI
[2009/11/08 11:22:55 | 000,000,145 | —- | C] () – C:\WINDOWS\System32\EBPPORT.DAT
[2009/11/08 11:12:18 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/10/25 08:40:13 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2009/06/28 20:02:02 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2009/06/28 14:32:24 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/06/28 14:26:03 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/06/28 10:09:14 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009/06/28 10:08:08 | 000,325,912 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/05/26 20:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 20:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2007/09/27 09:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 09:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 09:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2007/05/01 15:11:28 | 000,008,704 | —- | C] () – C:\WINDOWS\System32\SaiC0255_0C.dll
[2007/05/01 15:11:28 | 000,008,192 | —- | C] () – C:\WINDOWS\System32\SaiC0255_10.dll
[2007/05/01 15:11:28 | 000,008,192 | —- | C] () – C:\WINDOWS\System32\SaiC0255_0A.dll
[2007/05/01 15:11:28 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\SaiC0255_09.dll
[2007/05/01 15:11:28 | 000,005,632 | —- | C] () – C:\WINDOWS\System32\SaiC0255_11.dll
[2007/05/01 15:11:26 | 000,847,872 | —- | C] () – C:\WINDOWS\System32\SaiC0255.Dll
[2007/05/01 15:11:26 | 000,008,192 | —- | C] () – C:\WINDOWS\System32\SaiC0255_07.dll
[2007/05/01 15:11:26 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\SaiC0255_0402.dll
[2007/05/01 14:34:56 | 002,011,136 | —- | C] () – C:\WINDOWS\System32\SaiCFF12.Dll
[2007/05/01 14:34:56 | 000,008,704 | —- | C] () – C:\WINDOWS\System32\SaiCFF12_0C.dll
[2007/05/01 14:34:56 | 000,008,192 | —- | C] () – C:\WINDOWS\System32\SaiCFF12_10.dll
[2007/05/01 14:34:56 | 000,008,192 | —- | C] () – C:\WINDOWS\System32\SaiCFF12_0A.dll
[2007/05/01 14:34:56 | 000,008,192 | —- | C] () – C:\WINDOWS\System32\SaiCFF12_07.dll
[2007/05/01 14:34:56 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\SaiCFF12_09.dll
[2007/05/01 14:34:56 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\SaiCFF12_0402.dll
[2007/05/01 14:34:56 | 000,005,632 | —- | C] () – C:\WINDOWS\System32\SaiCFF12_11.dll
[2007/04/12 07:10:28 | 000,105,728 | —- | C] () – C:\WINDOWS\System32\APOMgrH.dll
[2007/04/09 11:55:14 | 000,097,785 | —- | C] () – C:\WINDOWS\System32\instwdm.ini
[2007/04/09 11:55:14 | 000,000,054 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2007/04/09 11:33:50 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CTBurst.dll
[2007/04/09 11:32:32 | 000,037,888 | —- | C] () – C:\WINDOWS\System32\psconv.exe
[2007/04/09 11:24:30 | 000,325,821 | —- | C] () – C:\WINDOWS\System32\ctdlang.dat
[2007/04/09 11:24:30 | 000,046,273 | —- | C] () – C:\WINDOWS\System32\ctdnlstr.dat
[2007/04/09 11:21:44 | 000,048,128 | —- | C] () – C:\WINDOWS\System32\regplib.exe
[2007/04/09 11:21:28 | 000,149,838 | —- | C] () – C:\WINDOWS\System32\ctbas2w.dat
[2007/04/09 11:19:44 | 000,274,587 | —- | C] () – C:\WINDOWS\System32\ctsbas2w.dat
[2007/04/09 11:19:36 | 000,241,084 | —- | C] () – C:\WINDOWS\System32\CTSBASW.DAT
[2007/04/09 11:19:36 | 000,115,166 | —- | C] () – C:\WINDOWS\System32\CTBASICW.DAT
[2007/04/09 11:19:20 | 000,313,207 | —- | C] () – C:\WINDOWS\System32\ctstatic.dat
[2007/04/09 11:19:20 | 000,053,932 | —- | C] () – C:\WINDOWS\System32\ctdaught.dat
[2007/04/09 11:19:18 | 000,005,120 | —- | C] () – C:\WINDOWS\System32\enlocstr.exe
[2007/03/16 16:00:00 | 000,003,403 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
[2006/12/05 13:05:04 | 000,114,688 | —- | C] () – C:\WINDOWS\System32\TosBtAcc.dll
[2006/10/02 08:25:18 | 000,000,307 | —- | C] () – C:\WINDOWS\System32\kill.ini
[2005/07/29 13:38:24 | 003,375,104 | —- | C] () – C:\WINDOWS\System32\qt-mt331.dll
[2005/07/22 21:30:18 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\TosCommAPI.dll
[2005/06/16 09:17:16 | 000,071,680 | —- | C] () – C:\WINDOWS\System32\ctmmactl.dll
[2005/03/21 18:48:05 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/21 18:48:05 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/11/12 23:04:23 | 000,004,256 | —- | C] () – C:\WINDOWS\System32\drivers\userport.sys
[2004/08/04 05:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 05:00:00 | 000,482,890 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 05:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 05:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 05:00:00 | 000,086,944 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 05:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 05:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 05:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 05:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 05:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/02 19:03:00 | 000,102,441 | —- | C] () – C:\WINDOWS\System32\getvpd.dll
[2004/08/02 19:03:00 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\getvpdc.exe
[2004/08/02 19:03:00 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\pmemw.dll
[2004/06/19 20:07:42 | 000,004,256 | —- | C] () – C:\WINDOWS\System32\userport.sys
[2004/03/11 00:26:10 | 000,406,016 | —- | C] () – C:\WINDOWS\System32\PSDrvCheck.exe

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0CFF5F08
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B9AB561D

< End of report >

Hello LDTate,

The computer is behaving normal. Below is the combofix log.

Thanks.
********************************************************************************
*********************************************************************************
*********************************************************************************
**
mboFix 12-01-07.03 - Thunder 01/08/2012 0:01.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.996 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Thunder\g2mdlhlpx.exe
c:\documents and settings\Thunder\WINDOWS
c:\windows\system32\PowerToyReadme.htm
.
.
((((((((((((((((((((((((( Files Created from 2011-12-08 to 2012-01-08 )))))))))))))))))))))))))))))))
.
.
2012-01-07 21:15 . 2012-01-07 21:15 29904 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FAEA012E-B327-4ECD-802C-E438EBDCDD48}\MpKsl1287b779.sys
2012-01-07 21:14 . 2012-01-07 21:14 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FAEA012E-B327-4ECD-802C-E438EBDCDD48}\offreg.dll
2012-01-07 21:14 . 2011-11-21 07:47 6823496 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FAEA012E-B327-4ECD-802C-E438EBDCDD48}\mpengine.dll
2012-01-06 14:41 . 2011-12-21 07:24 43992 —-a-w- c:\program files\Mozilla Firefox\mozutils.dll
2012-01-06 14:41 . 2011-12-21 04:30 626688 —-a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-01-06 14:41 . 2011-12-21 04:30 548864 —-a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-01-06 14:41 . 2011-12-21 04:30 479232 —-a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-01-06 14:35 . 2012-01-06 14:35 ——– d—–w- c:\program files\Common Files\Java
2012-01-06 14:28 . 2012-01-06 14:28 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-01-06 13:59 . 2012-01-06 13:59 ——– d—–w- c:\windows\system32\wbem\Repository
2012-01-06 08:05 . 2012-01-06 08:06 ——– d—–w- c:\windows\Microsoft Antimalware
2012-01-06 08:05 . 2012-01-06 08:05 ——– d—–w- c:\windows\Windows Defender Offline
11747-11-13 19:58 . 2011-03-18 20:46 ——– d-sh–w- c:\windows\xxclone.arc
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-06 14:28 . 2010-10-13 00:59 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-12-10 20:24 . 2011-03-10 14:12 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-06 17:45 . 2011-06-09 14:19 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-23 13:25 . 2004-08-04 10:00 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-21 07:47 . 2011-09-13 17:58 6823496 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-11-04 19:20 . 2006-03-04 03:33 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2004-08-04 10:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2004-08-04 10:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2004-08-04 10:00 385024 —-a-w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2004-08-04 10:00 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2004-08-04 10:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:33 . 2005-03-30 01:23 2192768 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2005-03-30 01:01 2069376 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13 . 2004-08-04 10:00 186880 —-a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22 . 2009-06-28 19:26 692736 —-a-w- c:\windows\system32\inetcomm.dll
2010-12-13 22:16 . 2011-01-25 01:37 9777448 -c–a-w- c:\program files\iTunes.exe
2010-01-27 03:11 . 2011-03-24 19:21 444283 —-a-w- c:\program files\Common Files\WinPcapNmap.exe
2011-12-21 07:24 . 2011-04-03 23:34 121816 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BMUpdate"="c:\windows\system32\BMUpdate.exe" [2001-07-03 176128]
"Iconoid"="c:\program files\Iconoid\iconoid.exe" [2007-02-03 274432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-08-03 4493312]
"CTHelper"="CTHELPER.EXE" [2007-04-09 19456]
"CTxfiHlp"="CTXFIHLP.EXE" [2007-04-09 19968]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"nwiz"="nwiz.exe" [2004-08-03 917504]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2010-11-06 274608]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-12-21 519584]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Thunder^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\Thunder\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2010 Screen Clipper and Launcher.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Thunder^Start Menu^Programs^Startup^reminder-ScanSoft Product Registration.lnk]
path=c:\documents and settings\Thunder\Start Menu\Programs\Startup\reminder-ScanSoft Product Registration.lnk
backup=c:\windows\pss\reminder-ScanSoft Product Registration.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59 937920 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58 37296 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 18:54 91520 —-a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Iconoid]
2007-02-03 22:38 274432 —-a-w- c:\program files\Iconoid\iconoid.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2004-08-03 00:03 917504 —-a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OneTouch Monitor]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCLEPCI]
2004-02-03 20:13 49152 —-a-w- c:\progra~1\Pinnacle\PPE\PPE.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
2004-03-11 05:26 406016 —-a-w- c:\windows\system32\PSDrvCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RIMBBLaunchAgent.exe]
2011-02-18 15:47 79192 —-a-w- c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-10-13 13:27 17351304 —-a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-06-09 18:06 254696 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-11-06 00:31 274608 —-a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WZCSVC"=2 (0x2)
"TOSHIBA Bluetooth Service"=2 (0x2)
"EPSONStatusAgent2"=2 (0x2)
"CiSvc"=3 (0x3)
"Bonjour Service"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"mnmsrvc"=3 (0x3)
"iPod Service"=3 (0x3)
"WSearch"=2 (0x2)
"RemoteRegistry"=2 (0x2)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"PinnacleSys.MediaServer"=2 (0x2)
"SQLAgent$PINNACLESYS"=3 (0x3)
"gusvc"=3 (0x3)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"UPS"=3 (0x3)
"FontCache3.0.0.0"=3 (0x3)
"WmdmPmSN"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\Thunder\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"e:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"e:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"e:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"e:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"e:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"=
"e:\\Program Files\\MOHAA.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"e:\\Program Files\\EA GAMES\\Medal of Honor Pacific Assault™\\mohpa.exe"=
"e:\\Program Files\\Electronic Arts\\Battlefield 2142 Deluxe Edition\\BF2142.exe"=
"e:\\Program Files\\Microsoft Games\\FS2002\\fs2002.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
"c:\\WINDOWS\\system32\\muzapp.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 MpKsl1287b779;MpKsl1287b779;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FAEA012E-B327-4ECD-802C-E438EBDCDD48}\MpKsl1287b779.sys [1/7/2012 4:15 PM 29904]
R1 UserPort;UserPort;c:\windows\system32\drivers\userport.sys [11/12/2004 11:04 PM 4256]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1/26/2010 9:09 PM 50704]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 8:37 PM 4640000]
S1 MpKsl0f34a1fc;MpKsl0f34a1fc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{29D7E432-4568-46EB-879A-838E187CB137}\MpKsl0f34a1fc.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{29D7E432-4568-46EB-879A-838E187CB137}\MpKsl0f34a1fc.sys [?]
S1 MpKsl0fb4c50f;MpKsl0fb4c50f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3E0AAF6A-A1A8-4B15-9A49-FE304D616114}\MpKsl0fb4c50f.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3E0AAF6A-A1A8-4B15-9A49-FE304D616114}\MpKsl0fb4c50f.sys [?]
S1 MpKsl1210831e;MpKsl1210831e;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B221F3CF-A2E0-49EC-B749-005EA416505C}\MpKsl1210831e.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B221F3CF-A2E0-49EC-B749-005EA416505C}\MpKsl1210831e.sys [?]
S1 MpKsl17696436;MpKsl17696436;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{040FD5E8-2A42-486A-A93E-75F59E8310BD}\MpKsl17696436.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{040FD5E8-2A42-486A-A93E-75F59E8310BD}\MpKsl17696436.sys [?]
S1 MpKsl1772d311;MpKsl1772d311;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FDF86324-2482-430B-A9A4-D57920FCD304}\MpKsl1772d311.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FDF86324-2482-430B-A9A4-D57920FCD304}\MpKsl1772d311.sys [?]
S1 MpKsl1a3dd799;MpKsl1a3dd799;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7AB5A594-6BE2-40AC-BEF6-3283E8D58C9E}\MpKsl1a3dd799.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7AB5A594-6BE2-40AC-BEF6-3283E8D58C9E}\MpKsl1a3dd799.sys [?]
S1 MpKsl1a9cd195;MpKsl1a9cd195;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1E77184A-41A9-4A87-9B70-FF20BC68CACB}\MpKsl1a9cd195.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1E77184A-41A9-4A87-9B70-FF20BC68CACB}\MpKsl1a9cd195.sys [?]
S1 MpKsl1b69fd2d;MpKsl1b69fd2d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{42225652-4FB0-4028-A3BD-5882A04BC64C}\MpKsl1b69fd2d.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{42225652-4FB0-4028-A3BD-5882A04BC64C}\MpKsl1b69fd2d.sys [?]
S1 MpKsl1e1bf4ff;MpKsl1e1bf4ff;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9B846FB-F84F-4471-A0DB-162F22B7E43C}\MpKsl1e1bf4ff.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9B846FB-F84F-4471-A0DB-162F22B7E43C}\MpKsl1e1bf4ff.sys [?]
S1 MpKsl1ee1499d;MpKsl1ee1499d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9944B66F-B3B2-4034-B922-46CEFCBF7580}\MpKsl1ee1499d.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9944B66F-B3B2-4034-B922-46CEFCBF7580}\MpKsl1ee1499d.sys [?]
S1 MpKsl204891c1;MpKsl204891c1;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D9B848C5-604E-417B-8D8F-021DB62B26D3}\MpKsl204891c1.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D9B848C5-604E-417B-8D8F-021DB62B26D3}\MpKsl204891c1.sys [?]
S1 MpKsl22be2d07;MpKsl22be2d07;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D605B8F5-9E19-4F54-AD06-78B7D1176008}\MpKsl22be2d07.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D605B8F5-9E19-4F54-AD06-78B7D1176008}\MpKsl22be2d07.sys [?]
S1 MpKsl25ba3cdc;MpKsl25ba3cdc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{42225652-4FB0-4028-A3BD-5882A04BC64C}\MpKsl25ba3cdc.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{42225652-4FB0-4028-A3BD-5882A04BC64C}\MpKsl25ba3cdc.sys [?]
S1 MpKsl2cb5fc9c;MpKsl2cb5fc9c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{503FFE99-9EC1-4137-88B3-293302CFDD76}\MpKsl2cb5fc9c.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{503FFE99-9EC1-4137-88B3-293302CFDD76}\MpKsl2cb5fc9c.sys [?]
S1 MpKsl2cbca307;MpKsl2cbca307;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FDF86324-2482-430B-A9A4-D57920FCD304}\MpKsl2cbca307.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FDF86324-2482-430B-A9A4-D57920FCD304}\MpKsl2cbca307.sys [?]
S1 MpKsl31411e90;MpKsl31411e90;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D7F44786-ACB6-466E-B6E3-635A046C64DB}\MpKsl31411e90.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D7F44786-ACB6-466E-B6E3-635A046C64DB}\MpKsl31411e90.sys [?]
S1 MpKsl31b66de6;MpKsl31b66de6;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{59064494-4F3D-4D6E-B212-A9F258CFB0A5}\MpKsl31b66de6.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{59064494-4F3D-4D6E-B212-A9F258CFB0A5}\MpKsl31b66de6.sys [?]
S1 MpKsl358a3e83;MpKsl358a3e83;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6A27EBA4-ABE3-4C95-AEE7-4BF1135C39BB}\MpKsl358a3e83.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6A27EBA4-ABE3-4C95-AEE7-4BF1135C39BB}\MpKsl358a3e83.sys [?]
S1 MpKsl37f221c1;MpKsl37f221c1;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0A7BED23-726E-410E-BF78-7DE26E9FC338}\MpKsl37f221c1.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0A7BED23-726E-410E-BF78-7DE26E9FC338}\MpKsl37f221c1.sys [?]
S1 MpKsl3ddb0f41;MpKsl3ddb0f41;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DF48048F-B1A5-43A9-A22B-77F29B747070}\MpKsl3ddb0f41.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DF48048F-B1A5-43A9-A22B-77F29B747070}\MpKsl3ddb0f41.sys [?]
S1 MpKsl3eab936d;MpKsl3eab936d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1D587835-B8C9-4045-B073-11D2C0F65201}\MpKsl3eab936d.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1D587835-B8C9-4045-B073-11D2C0F65201}\MpKsl3eab936d.sys [?]
S1 MpKsl44d8a1b9;MpKsl44d8a1b9;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{442DC1D1-FE32-4547-90C8-0CC3BB9324EE}\MpKsl44d8a1b9.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{442DC1D1-FE32-4547-90C8-0CC3BB9324EE}\MpKsl44d8a1b9.sys [?]
S1 MpKsl45670f2a;MpKsl45670f2a;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55336A53-3275-42D0-BA34-7B736B7177F0}\MpKsl45670f2a.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55336A53-3275-42D0-BA34-7B736B7177F0}\MpKsl45670f2a.sys [?]
S1 MpKsl49eb7279;MpKsl49eb7279;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EAB585D-B6EF-43EA-8CEE-7E4FEAAFD767}\MpKsl49eb7279.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EAB585D-B6EF-43EA-8CEE-7E4FEAAFD767}\MpKsl49eb7279.sys [?]
S1 MpKsl4adf5f09;MpKsl4adf5f09;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D1913AD1-AA47-4E41-AFB9-54F9B77F9AFC}\MpKsl4adf5f09.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D1913AD1-AA47-4E41-AFB9-54F9B77F9AFC}\MpKsl4adf5f09.sys [?]
S1 MpKsl5078a467;MpKsl5078a467;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{503FFE99-9EC1-4137-88B3-293302CFDD76}\MpKsl5078a467.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{503FFE99-9EC1-4137-88B3-293302CFDD76}\MpKsl5078a467.sys [?]
S1 MpKsl5293d16b;MpKsl5293d16b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{825578B0-3466-4275-9A78-85AD38D33ED1}\MpKsl5293d16b.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{825578B0-3466-4275-9A78-85AD38D33ED1}\MpKsl5293d16b.sys [?]
S1 MpKsl5599a20c;MpKsl5599a20c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E240C6C8-F1A5-425B-A04C-08DC74AE44F4}\MpKsl5599a20c.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E240C6C8-F1A5-425B-A04C-08DC74AE44F4}\MpKsl5599a20c.sys [?]
S1 MpKsl572ed4e8;MpKsl572ed4e8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{45EB30AB-03AC-4CE9-A850-B65EE0ACAEFC}\MpKsl572ed4e8.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{45EB30AB-03AC-4CE9-A850-B65EE0ACAEFC}\MpKsl572ed4e8.sys [?]
S1 MpKsl5900e354;MpKsl5900e354;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9804ACDD-8173-47E7-8305-986C54BD5A7E}\MpKsl5900e354.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9804ACDD-8173-47E7-8305-986C54BD5A7E}\MpKsl5900e354.sys [?]
S1 MpKsl59f6bbbe;MpKsl59f6bbbe;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{825578B0-3466-4275-9A78-85AD38D33ED1}\MpKsl59f6bbbe.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{825578B0-3466-4275-9A78-85AD38D33ED1}\MpKsl59f6bbbe.sys [?]
S1 MpKsl5a438644;MpKsl5a438644;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CC4B68ED-363A-4929-AEFF-1302EE9E7B39}\MpKsl5a438644.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CC4B68ED-363A-4929-AEFF-1302EE9E7B39}\MpKsl5a438644.sys [?]
S1 MpKsl5b0d4e53;MpKsl5b0d4e53;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9944B66F-B3B2-4034-B922-46CEFCBF7580}\MpKsl5b0d4e53.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9944B66F-B3B2-4034-B922-46CEFCBF7580}\MpKsl5b0d4e53.sys [?]
S1 MpKsl5c0aa071;MpKsl5c0aa071;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{85E3741E-5612-4640-A047-D96E0782E7F0}\MpKsl5c0aa071.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{85E3741E-5612-4640-A047-D96E0782E7F0}\MpKsl5c0aa071.sys [?]
S1 MpKsl5f8958ab;MpKsl5f8958ab;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1B3B18FD-7DB3-47D9-8150-FBF34E083880}\MpKsl5f8958ab.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1B3B18FD-7DB3-47D9-8150-FBF34E083880}\MpKsl5f8958ab.sys [?]
S1 MpKsl606da008;MpKsl606da008;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{85E3741E-5612-4640-A047-D96E0782E7F0}\MpKsl606da008.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{85E3741E-5612-4640-A047-D96E0782E7F0}\MpKsl606da008.sys [?]
S1 MpKsl66055919;MpKsl66055919;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55A4A94B-8293-452E-A87F-8F100CE7F3B5}\MpKsl66055919.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55A4A94B-8293-452E-A87F-8F100CE7F3B5}\MpKsl66055919.sys [?]
S1 MpKsl6a6124bb;MpKsl6a6124bb;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{14CBA0B7-D57B-44F2-8B0C-0FCDBDA600C3}\MpKsl6a6124bb.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{14CBA0B7-D57B-44F2-8B0C-0FCDBDA600C3}\MpKsl6a6124bb.sys [?]
S1 MpKsl6da67626;MpKsl6da67626;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CC4B68ED-363A-4929-AEFF-1302EE9E7B39}\MpKsl6da67626.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CC4B68ED-363A-4929-AEFF-1302EE9E7B39}\MpKsl6da67626.sys [?]
S1 MpKsl6dd947b5;MpKsl6dd947b5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{344FB8BE-F9A1-4D76-9B63-764211912565}\MpKsl6dd947b5.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{344FB8BE-F9A1-4D76-9B63-764211912565}\MpKsl6dd947b5.sys [?]
S1 MpKsl7eb76ab6;MpKsl7eb76ab6;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{45EB30AB-03AC-4CE9-A850-B65EE0ACAEFC}\MpKsl7eb76ab6.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{45EB30AB-03AC-4CE9-A850-B65EE0ACAEFC}\MpKsl7eb76ab6.sys [?]
S1 MpKsl7f933105;MpKsl7f933105;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D7F44786-ACB6-466E-B6E3-635A046C64DB}\MpKsl7f933105.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D7F44786-ACB6-466E-B6E3-635A046C64DB}\MpKsl7f933105.sys [?]
S1 MpKsl802c89d5;MpKsl802c89d5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DF48048F-B1A5-43A9-A22B-77F29B747070}\MpKsl802c89d5.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DF48048F-B1A5-43A9-A22B-77F29B747070}\MpKsl802c89d5.sys [?]
S1 MpKsl80ae0e7a;MpKsl80ae0e7a;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7BAFFF63-B723-436A-A62C-202DB48EAE93}\MpKsl80ae0e7a.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7BAFFF63-B723-436A-A62C-202DB48EAE93}\MpKsl80ae0e7a.sys [?]
S1 MpKsl864db80c;MpKsl864db80c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7AB5A594-6BE2-40AC-BEF6-3283E8D58C9E}\MpKsl864db80c.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7AB5A594-6BE2-40AC-BEF6-3283E8D58C9E}\MpKsl864db80c.sys [?]
S1 MpKsl934b1ef3;MpKsl934b1ef3;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{01C0C600-C2BE-40C7-B601-36E153D4C884}\MpKsl934b1ef3.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{01C0C600-C2BE-40C7-B601-36E153D4C884}\MpKsl934b1ef3.sys [?]
S1 MpKsl9b5f89b7;MpKsl9b5f89b7;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{325DA6A0-B1FE-471E-B7DA-0F478A0B7C8E}\MpKsl9b5f89b7.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{325DA6A0-B1FE-471E-B7DA-0F478A0B7C8E}\MpKsl9b5f89b7.sys [?]
S1 MpKsla4981242;MpKsla4981242;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9944B66F-B3B2-4034-B922-46CEFCBF7580}\MpKsla4981242.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9944B66F-B3B2-4034-B922-46CEFCBF7580}\MpKsla4981242.sys [?]
S1 MpKsla79f1fd7;MpKsla79f1fd7;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{14CBA0B7-D57B-44F2-8B0C-0FCDBDA600C3}\MpKsla79f1fd7.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{14CBA0B7-D57B-44F2-8B0C-0FCDBDA600C3}\MpKsla79f1fd7.sys [?]
S1 MpKslacb04c91;MpKslacb04c91;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1B3B18FD-7DB3-47D9-8150-FBF34E083880}\MpKslacb04c91.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1B3B18FD-7DB3-47D9-8150-FBF34E083880}\MpKslacb04c91.sys [?]
S1 MpKslc07db79c;MpKslc07db79c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55A4A94B-8293-452E-A87F-8F100CE7F3B5}\MpKslc07db79c.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55A4A94B-8293-452E-A87F-8F100CE7F3B5}\MpKslc07db79c.sys [?]
S1 MpKslc22e3731;MpKslc22e3731;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D605B8F5-9E19-4F54-AD06-78B7D1176008}\MpKslc22e3731.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D605B8F5-9E19-4F54-AD06-78B7D1176008}\MpKslc22e3731.sys [?]
S1 MpKslc6c34cca;MpKslc6c34cca;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{503FFE99-9EC1-4137-88B3-293302CFDD76}\MpKslc6c34cca.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{503FFE99-9EC1-4137-88B3-293302CFDD76}\MpKslc6c34cca.sys [?]
S1 MpKslce0fb214;MpKslce0fb214;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0A238AEC-B20D-48A5-9640-4D54C15AFA65}\MpKslce0fb214.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0A238AEC-B20D-48A5-9640-4D54C15AFA65}\MpKslce0fb214.sys [?]
S1 MpKsld0b39f16;MpKsld0b39f16;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9B846FB-F84F-4471-A0DB-162F22B7E43C}\MpKsld0b39f16.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9B846FB-F84F-4471-A0DB-162F22B7E43C}\MpKsld0b39f16.sys [?]
S1 MpKsld404af1f;MpKsld404af1f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DF48048F-B1A5-43A9-A22B-77F29B747070}\MpKsld404af1f.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DF48048F-B1A5-43A9-A22B-77F29B747070}\MpKsld404af1f.sys [?]
S1 MpKsld6c938b5;MpKsld6c938b5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EAB585D-B6EF-43EA-8CEE-7E4FEAAFD767}\MpKsld6c938b5.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EAB585D-B6EF-43EA-8CEE-7E4FEAAFD767}\MpKsld6c938b5.sys [?]
S1 MpKslda6ad503;MpKslda6ad503;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8B8C44DA-B691-4437-B49E-FF42C49BFC61}\MpKslda6ad503.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8B8C44DA-B691-4437-B49E-FF42C49BFC61}\MpKslda6ad503.sys [?]
S1 MpKsle6b36ab5;MpKsle6b36ab5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D9B848C5-604E-417B-8D8F-021DB62B26D3}\MpKsle6b36ab5.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D9B848C5-604E-417B-8D8F-021DB62B26D3}\MpKsle6b36ab5.sys [?]
S1 MpKsle801b08f;MpKsle801b08f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{29D7E432-4568-46EB-879A-838E187CB137}\MpKsle801b08f.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{29D7E432-4568-46EB-879A-838E187CB137}\MpKsle801b08f.sys [?]
S1 MpKsle94871fb;MpKsle94871fb;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C6AE095C-5082-4401-93AC-6B2AEED74157}\MpKsle94871fb.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C6AE095C-5082-4401-93AC-6B2AEED74157}\MpKsle94871fb.sys [?]
S1 MpKslfcebdd89;MpKslfcebdd89;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D7F44786-ACB6-466E-B6E3-635A046C64DB}\MpKslfcebdd89.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D7F44786-ACB6-466E-B6E3-635A046C64DB}\MpKslfcebdd89.sys [?]
S1 MpKslfdb183f8;MpKslfdb183f8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4263EA77-166E-4BA4-9F86-AE5A77D29F49}\MpKslfdb183f8.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4263EA77-166E-4BA4-9F86-AE5A77D29F49}\MpKslfdb183f8.sys [?]
S1 MpKslfe3bbf65;MpKslfe3bbf65;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{19C4195A-827B-415B-8CB6-3915B64FD4B0}\MpKslfe3bbf65.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{19C4195A-827B-415B-8CB6-3915B64FD4B0}\MpKslfe3bbf65.sys [?]
S1 MpKslfeba29d1;MpKslfeba29d1;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CB63FF0E-C896-4DE7-BBEB-58D96A96DB90}\MpKslfeba29d1.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CB63FF0E-C896-4DE7-BBEB-58D96A96DB90}\MpKslfeba29d1.sys [?]
S3 brfilt;Brother MFC Filter Driver;c:\windows\system32\drivers\BrFilt.sys [1/31/2010 4:37 PM 2944]
S3 brparimg;Brother Multi Function Parallel Image driver;c:\windows\system32\drivers\BrParImg.sys [9/5/2010 2:30 PM 3168]
S3 BrParWdm;Brother WDM Parallel Driver;c:\windows\system32\drivers\BrParwdm.sys [9/5/2010 2:29 PM 39552]
S3 BrSerWDM;Brother WDM Serial driver;c:\windows\system32\drivers\BrSerWdm.sys [1/31/2010 4:37 PM 60416]
S3 BrUsbMdm;Brother MFC USB Fax Only Modem;c:\windows\system32\drivers\BrUsbMdm.sys [1/31/2010 4:37 PM 11008]
S3 BrUsbScn;Brother MFC USB Scanner driver;c:\windows\system32\drivers\BrUsbScn.sys [1/31/2010 4:37 PM 10368]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [6/12/2011 10:15 AM 31125880]
S3 SaiH0255;SaiH0255;c:\windows\system32\drivers\SaiH0255.sys [5/1/2007 3:11 PM 132232]
S3 SaiHFF12;SaiHFF12;c:\windows\system32\drivers\SaiHFF12.sys [5/1/2007 2:34 PM 132232]
S3 SaiIFF12;Immersion's HID USB Driver (FF12);c:\windows\system32\drivers\SaiIFF12.sys [5/1/2007 2:34 PM 16256]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [8/22/2011 3:55 PM 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [8/22/2011 3:55 PM 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [8/22/2011 3:55 PM 136808]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/30/2010 12:46 PM 136176]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [8/30/2010 12:46 PM 136176]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - MBAMSWISSARMY
*NewlyCreated* - MPKSL1287B779
*Deregistered* - MBAMSwissArmy
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-30 17:46]
.
2012-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-30 17:46]
.
2012-01-07 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
2012-01-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1844237615-1409082233-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-10-20 22:32]
.
2012-01-07 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1844237615-1409082233-725345543-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-10-20 22:32]
.
2012-01-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1844237615-1409082233-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-10-20 22:32]
.
2012-01-06 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1844237615-1409082233-725345543-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-10-20 22:32]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Thunder\Application Data\Mozilla\Firefox\Profiles\4ddqcgf1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1572363&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - file:///C:/Documents%20and%20Settings/Thunder/Desktop/bookmarks.html
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=937811&p=
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-Adobe Photo Downloader - e:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
MSConfigStartUp-Google Update - c:\documents and settings\Thunder\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-SmileboxTray - c:\documents and settings\Thunder\Application Data\Smilebox\SmileboxTray.exe
HKLM_ActiveSetup-{FBA04E6E-3ED2-3F3F-CEBC-8DCBE538EEBB} - c:\documents and settings\Thunder\Application Data\beta.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
AddRemove-26_VIA_driver2 - c:\program files\Samsung\USB Drivers\26_VIA_driver2\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-08 00:11
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2012-01-08 00:14:24
ComboFix-quarantined-files.txt 2012-01-08 05:14
.
Pre-Run: 2,473,201,664 bytes free
Post-Run: 6,498,594,816 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 826298832C0184675FC337CD546601B6

Hello LDTate,

I followed your instructions, please find the ComboFix log below. The computer seems to be OK at the exception of the sound and Microsoft essentials icons; in order for them to be present in the tray, I have to log off an then log back on, just an annoyance (I had this issue before my infection).
Thanks !!!
********************************************************************************
*******************************************************
ComboFix 12-01-07.03 - Thunder 01/08/2012 12:11:59.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1081 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Thunder\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\windows\iun6002.exe
c:\windows\system32\muzapp.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-12-08 to 2012-01-08 )))))))))))))))))))))))))))))))
.
.
2012-01-08 17:23 . 2012-01-08 17:23 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{824F259F-097D-4D5D-9CC6-B11AFF2F586A}\offreg.dll
2012-01-08 17:00 . 2012-01-08 17:00 29904 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{824F259F-097D-4D5D-9CC6-B11AFF2F586A}\MpKsl37088df3.sys
2012-01-08 05:19 . 2011-11-21 07:47 6823496 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{824F259F-097D-4D5D-9CC6-B11AFF2F586A}\mpengine.dll
2012-01-06 14:41 . 2011-12-21 07:24 43992 —-a-w- c:\program files\Mozilla Firefox\mozutils.dll
2012-01-06 14:41 . 2011-12-21 04:30 626688 —-a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-01-06 14:41 . 2011-12-21 04:30 548864 —-a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-01-06 14:41 . 2011-12-21 04:30 479232 —-a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-01-06 14:35 . 2012-01-06 14:35 ——– d—–w- c:\program files\Common Files\Java
2012-01-06 14:28 . 2012-01-06 14:28 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-01-06 13:59 . 2012-01-06 13:59 ——– d—–w- c:\windows\system32\wbem\Repository
2012-01-06 08:05 . 2012-01-06 08:06 ——– d—–w- c:\windows\Microsoft Antimalware
2012-01-06 08:05 . 2012-01-06 08:05 ——– d—–w- c:\windows\Windows Defender Offline
11747-11-13 19:58 . 2011-03-18 20:46 ——– d-sh–w- c:\windows\xxclone.arc
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-06 14:28 . 2010-10-13 00:59 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-12-10 20:24 . 2011-03-10 14:12 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-06 17:45 . 2011-06-09 14:19 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-23 13:25 . 2004-08-04 10:00 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-21 07:47 . 2011-09-13 17:58 6823496 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-11-04 19:20 . 2006-03-04 03:33 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2004-08-04 10:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2004-08-04 10:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2004-08-04 10:00 385024 —-a-w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2004-08-04 10:00 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2004-08-04 10:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:33 . 2005-03-30 01:23 2192768 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2005-03-30 01:01 2069376 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13 . 2004-08-04 10:00 186880 —-a-w- c:\windows\system32\encdec.dll
2010-12-13 22:16 . 2011-01-25 01:37 9777448 -c–a-w- c:\program files\iTunes.exe
2010-01-27 03:11 . 2011-03-24 19:21 444283 —-a-w- c:\program files\Common Files\WinPcapNmap.exe
2011-12-21 07:24 . 2011-04-03 23:34 121816 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-08_05.11.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-08 17:22 . 2012-01-08 17:22 16384 c:\windows\temp\Perflib_Perfdata_c4.dat
+ 2012-01-08 17:22 . 2012-01-08 17:22 16384 c:\windows\temp\Perflib_Perfdata_340.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BMUpdate"="c:\windows\system32\BMUpdate.exe" [2001-07-03 176128]
"Iconoid"="c:\program files\Iconoid\iconoid.exe" [2007-02-03 274432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-08-03 4493312]
"CTHelper"="CTHELPER.EXE" [2007-04-09 19456]
"CTxfiHlp"="CTXFIHLP.EXE" [2007-04-09 19968]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"nwiz"="nwiz.exe" [2004-08-03 917504]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2010-11-06 274608]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-12-21 519584]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Thunder^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\Thunder\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2010 Screen Clipper and Launcher.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Thunder^Start Menu^Programs^Startup^reminder-ScanSoft Product Registration.lnk]
path=c:\documents and settings\Thunder\Start Menu\Programs\Startup\reminder-ScanSoft Product Registration.lnk
backup=c:\windows\pss\reminder-ScanSoft Product Registration.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59 937920 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58 37296 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 18:54 91520 —-a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Iconoid]
2007-02-03 22:38 274432 —-a-w- c:\program files\Iconoid\iconoid.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2004-08-03 00:03 917504 —-a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OneTouch Monitor]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCLEPCI]
2004-02-03 20:13 49152 —-a-w- c:\progra~1\Pinnacle\PPE\PPE.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
2004-03-11 05:26 406016 —-a-w- c:\windows\system32\PSDrvCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RIMBBLaunchAgent.exe]
2011-02-18 15:47 79192 —-a-w- c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-10-13 13:27 17351304 —-a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-06-09 18:06 254696 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-11-06 00:31 274608 —-a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WZCSVC"=2 (0x2)
"TOSHIBA Bluetooth Service"=2 (0x2)
"EPSONStatusAgent2"=2 (0x2)
"CiSvc"=3 (0x3)
"Bonjour Service"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"mnmsrvc"=3 (0x3)
"iPod Service"=3 (0x3)
"WSearch"=2 (0x2)
"RemoteRegistry"=2 (0x2)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"PinnacleSys.MediaServer"=2 (0x2)
"SQLAgent$PINNACLESYS"=3 (0x3)
"gusvc"=3 (0x3)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"UPS"=3 (0x3)
"FontCache3.0.0.0"=3 (0x3)
"WmdmPmSN"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\Thunder\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"e:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"e:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"e:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"e:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"e:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"=
"e:\\Program Files\\MOHAA.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"e:\\Program Files\\EA GAMES\\Medal of Honor Pacific Assault™\\mohpa.exe"=
"e:\\Program Files\\Electronic Arts\\Battlefield 2142 Deluxe Edition\\BF2142.exe"=
"e:\\Program Files\\Microsoft Games\\FS2002\\fs2002.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 MpKsl37088df3;MpKsl37088df3;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{824F259F-097D-4D5D-9CC6-B11AFF2F586A}\MpKsl37088df3.sys [1/8/2012 12:00 PM 29904]
R1 UserPort;UserPort;c:\windows\system32\drivers\userport.sys [11/12/2004 11:04 PM 4256]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1/26/2010 9:09 PM 50704]
S1 MpKsl0f34a1fc;MpKsl0f34a1fc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{29D7E432-4568-46EB-879A-838E187CB137}\MpKsl0f34a1fc.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{29D7E432-4568-46EB-879A-838E187CB137}\MpKsl0f34a1fc.sys [?]
S1 MpKsl0fb4c50f;MpKsl0fb4c50f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3E0AAF6A-A1A8-4B15-9A49-FE304D616114}\MpKsl0fb4c50f.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3E0AAF6A-A1A8-4B15-9A49-FE304D616114}\MpKsl0fb4c50f.sys [?]
S1 MpKsl1210831e;MpKsl1210831e;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B221F3CF-A2E0-49EC-B749-005EA416505C}\MpKsl1210831e.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B221F3CF-A2E0-49EC-B749-005EA416505C}\MpKsl1210831e.sys [?]
S1 MpKsl17696436;MpKsl17696436;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{040FD5E8-2A42-486A-A93E-75F59E8310BD}\MpKsl17696436.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{040FD5E8-2A42-486A-A93E-75F59E8310BD}\MpKsl17696436.sys [?]
S1 MpKsl1772d311;MpKsl1772d311;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FDF86324-2482-430B-A9A4-D57920FCD304}\MpKsl1772d311.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FDF86324-2482-430B-A9A4-D57920FCD304}\MpKsl1772d311.sys [?]
S1 MpKsl1a3dd799;MpKsl1a3dd799;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7AB5A594-6BE2-40AC-BEF6-3283E8D58C9E}\MpKsl1a3dd799.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7AB5A594-6BE2-40AC-BEF6-3283E8D58C9E}\MpKsl1a3dd799.sys [?]
S1 MpKsl1a9cd195;MpKsl1a9cd195;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1E77184A-41A9-4A87-9B70-FF20BC68CACB}\MpKsl1a9cd195.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1E77184A-41A9-4A87-9B70-FF20BC68CACB}\MpKsl1a9cd195.sys [?]
S1 MpKsl1b69fd2d;MpKsl1b69fd2d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{42225652-4FB0-4028-A3BD-5882A04BC64C}\MpKsl1b69fd2d.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{42225652-4FB0-4028-A3BD-5882A04BC64C}\MpKsl1b69fd2d.sys [?]
S1 MpKsl1e1bf4ff;MpKsl1e1bf4ff;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9B846FB-F84F-4471-A0DB-162F22B7E43C}\MpKsl1e1bf4ff.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9B846FB-F84F-4471-A0DB-162F22B7E43C}\MpKsl1e1bf4ff.sys [?]
S1 MpKsl1ee1499d;MpKsl1ee1499d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9944B66F-B3B2-4034-B922-46CEFCBF7580}\MpKsl1ee1499d.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9944B66F-B3B2-4034-B922-46CEFCBF7580}\MpKsl1ee1499d.sys [?]
S1 MpKsl204891c1;MpKsl204891c1;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D9B848C5-604E-417B-8D8F-021DB62B26D3}\MpKsl204891c1.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D9B848C5-604E-417B-8D8F-021DB62B26D3}\MpKsl204891c1.sys [?]
S1 MpKsl22be2d07;MpKsl22be2d07;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D605B8F5-9E19-4F54-AD06-78B7D1176008}\MpKsl22be2d07.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D605B8F5-9E19-4F54-AD06-78B7D1176008}\MpKsl22be2d07.sys [?]
S1 MpKsl25ba3cdc;MpKsl25ba3cdc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{42225652-4FB0-4028-A3BD-5882A04BC64C}\MpKsl25ba3cdc.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{42225652-4FB0-4028-A3BD-5882A04BC64C}\MpKsl25ba3cdc.sys [?]
S1 MpKsl2cb5fc9c;MpKsl2cb5fc9c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{503FFE99-9EC1-4137-88B3-293302CFDD76}\MpKsl2cb5fc9c.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{503FFE99-9EC1-4137-88B3-293302CFDD76}\MpKsl2cb5fc9c.sys [?]
S1 MpKsl2cbca307;MpKsl2cbca307;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FDF86324-2482-430B-A9A4-D57920FCD304}\MpKsl2cbca307.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FDF86324-2482-430B-A9A4-D57920FCD304}\MpKsl2cbca307.sys [?]
S1 MpKsl31411e90;MpKsl31411e90;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D7F44786-ACB6-466E-B6E3-635A046C64DB}\MpKsl31411e90.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D7F44786-ACB6-466E-B6E3-635A046C64DB}\MpKsl31411e90.sys [?]
S1 MpKsl31b66de6;MpKsl31b66de6;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{59064494-4F3D-4D6E-B212-A9F258CFB0A5}\MpKsl31b66de6.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{59064494-4F3D-4D6E-B212-A9F258CFB0A5}\MpKsl31b66de6.sys [?]
S1 MpKsl358a3e83;MpKsl358a3e83;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6A27EBA4-ABE3-4C95-AEE7-4BF1135C39BB}\MpKsl358a3e83.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6A27EBA4-ABE3-4C95-AEE7-4BF1135C39BB}\MpKsl358a3e83.sys [?]
S1 MpKsl37f221c1;MpKsl37f221c1;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0A7BED23-726E-410E-BF78-7DE26E9FC338}\MpKsl37f221c1.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0A7BED23-726E-410E-BF78-7DE26E9FC338}\MpKsl37f221c1.sys [?]
S1 MpKsl3ddb0f41;MpKsl3ddb0f41;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DF48048F-B1A5-43A9-A22B-77F29B747070}\MpKsl3ddb0f41.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DF48048F-B1A5-43A9-A22B-77F29B747070}\MpKsl3ddb0f41.sys [?]
S1 MpKsl3eab936d;MpKsl3eab936d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1D587835-B8C9-4045-B073-11D2C0F65201}\MpKsl3eab936d.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1D587835-B8C9-4045-B073-11D2C0F65201}\MpKsl3eab936d.sys [?]
S1 MpKsl44d8a1b9;MpKsl44d8a1b9;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{442DC1D1-FE32-4547-90C8-0CC3BB9324EE}\MpKsl44d8a1b9.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{442DC1D1-FE32-4547-90C8-0CC3BB9324EE}\MpKsl44d8a1b9.sys [?]
S1 MpKsl45670f2a;MpKsl45670f2a;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55336A53-3275-42D0-BA34-7B736B7177F0}\MpKsl45670f2a.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55336A53-3275-42D0-BA34-7B736B7177F0}\MpKsl45670f2a.sys [?]
S1 MpKsl49eb7279;MpKsl49eb7279;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EAB585D-B6EF-43EA-8CEE-7E4FEAAFD767}\MpKsl49eb7279.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EAB585D-B6EF-43EA-8CEE-7E4FEAAFD767}\MpKsl49eb7279.sys [?]
S1 MpKsl4adf5f09;MpKsl4adf5f09;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D1913AD1-AA47-4E41-AFB9-54F9B77F9AFC}\MpKsl4adf5f09.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D1913AD1-AA47-4E41-AFB9-54F9B77F9AFC}\MpKsl4adf5f09.sys [?]
S1 MpKsl5078a467;MpKsl5078a467;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{503FFE99-9EC1-4137-88B3-293302CFDD76}\MpKsl5078a467.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{503FFE99-9EC1-4137-88B3-293302CFDD76}\MpKsl5078a467.sys [?]
S1 MpKsl5293d16b;MpKsl5293d16b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{825578B0-3466-4275-9A78-85AD38D33ED1}\MpKsl5293d16b.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{825578B0-3466-4275-9A78-85AD38D33ED1}\MpKsl5293d16b.sys [?]
S1 MpKsl5599a20c;MpKsl5599a20c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E240C6C8-F1A5-425B-A04C-08DC74AE44F4}\MpKsl5599a20c.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E240C6C8-F1A5-425B-A04C-08DC74AE44F4}\MpKsl5599a20c.sys [?]
S1 MpKsl572ed4e8;MpKsl572ed4e8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{45EB30AB-03AC-4CE9-A850-B65EE0ACAEFC}\MpKsl572ed4e8.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{45EB30AB-03AC-4CE9-A850-B65EE0ACAEFC}\MpKsl572ed4e8.sys [?]
S1 MpKsl5900e354;MpKsl5900e354;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9804ACDD-8173-47E7-8305-986C54BD5A7E}\MpKsl5900e354.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9804ACDD-8173-47E7-8305-986C54BD5A7E}\MpKsl5900e354.sys [?]
S1 MpKsl59f6bbbe;MpKsl59f6bbbe;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{825578B0-3466-4275-9A78-85AD38D33ED1}\MpKsl59f6bbbe.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{825578B0-3466-4275-9A78-85AD38D33ED1}\MpKsl59f6bbbe.sys [?]
S1 MpKsl5a438644;MpKsl5a438644;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CC4B68ED-363A-4929-AEFF-1302EE9E7B39}\MpKsl5a438644.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CC4B68ED-363A-4929-AEFF-1302EE9E7B39}\MpKsl5a438644.sys [?]
S1 MpKsl5b0d4e53;MpKsl5b0d4e53;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9944B66F-B3B2-4034-B922-46CEFCBF7580}\MpKsl5b0d4e53.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9944B66F-B3B2-4034-B922-46CEFCBF7580}\MpKsl5b0d4e53.sys [?]
S1 MpKsl5c0aa071;MpKsl5c0aa071;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{85E3741E-5612-4640-A047-D96E0782E7F0}\MpKsl5c0aa071.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{85E3741E-5612-4640-A047-D96E0782E7F0}\MpKsl5c0aa071.sys [?]
S1 MpKsl5f8958ab;MpKsl5f8958ab;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1B3B18FD-7DB3-47D9-8150-FBF34E083880}\MpKsl5f8958ab.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1B3B18FD-7DB3-47D9-8150-FBF34E083880}\MpKsl5f8958ab.sys [?]
S1 MpKsl606da008;MpKsl606da008;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{85E3741E-5612-4640-A047-D96E0782E7F0}\MpKsl606da008.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{85E3741E-5612-4640-A047-D96E0782E7F0}\MpKsl606da008.sys [?]
S1 MpKsl66055919;MpKsl66055919;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55A4A94B-8293-452E-A87F-8F100CE7F3B5}\MpKsl66055919.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55A4A94B-8293-452E-A87F-8F100CE7F3B5}\MpKsl66055919.sys [?]
S1 MpKsl6a6124bb;MpKsl6a6124bb;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{14CBA0B7-D57B-44F2-8B0C-0FCDBDA600C3}\MpKsl6a6124bb.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{14CBA0B7-D57B-44F2-8B0C-0FCDBDA600C3}\MpKsl6a6124bb.sys [?]
S1 MpKsl6da67626;MpKsl6da67626;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CC4B68ED-363A-4929-AEFF-1302EE9E7B39}\MpKsl6da67626.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CC4B68ED-363A-4929-AEFF-1302EE9E7B39}\MpKsl6da67626.sys [?]
S1 MpKsl6dd947b5;MpKsl6dd947b5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{344FB8BE-F9A1-4D76-9B63-764211912565}\MpKsl6dd947b5.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{344FB8BE-F9A1-4D76-9B63-764211912565}\MpKsl6dd947b5.sys [?]
S1 MpKsl7eb76ab6;MpKsl7eb76ab6;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{45EB30AB-03AC-4CE9-A850-B65EE0ACAEFC}\MpKsl7eb76ab6.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{45EB30AB-03AC-4CE9-A850-B65EE0ACAEFC}\MpKsl7eb76ab6.sys [?]
S1 MpKsl7f933105;MpKsl7f933105;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D7F44786-ACB6-466E-B6E3-635A046C64DB}\MpKsl7f933105.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D7F44786-ACB6-466E-B6E3-635A046C64DB}\MpKsl7f933105.sys [?]
S1 MpKsl802c89d5;MpKsl802c89d5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DF48048F-B1A5-43A9-A22B-77F29B747070}\MpKsl802c89d5.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DF48048F-B1A5-43A9-A22B-77F29B747070}\MpKsl802c89d5.sys [?]
S1 MpKsl80ae0e7a;MpKsl80ae0e7a;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7BAFFF63-B723-436A-A62C-202DB48EAE93}\MpKsl80ae0e7a.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7BAFFF63-B723-436A-A62C-202DB48EAE93}\MpKsl80ae0e7a.sys [?]
S1 MpKsl864db80c;MpKsl864db80c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7AB5A594-6BE2-40AC-BEF6-3283E8D58C9E}\MpKsl864db80c.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7AB5A594-6BE2-40AC-BEF6-3283E8D58C9E}\MpKsl864db80c.sys [?]
S1 MpKsl934b1ef3;MpKsl934b1ef3;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{01C0C600-C2BE-40C7-B601-36E153D4C884}\MpKsl934b1ef3.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{01C0C600-C2BE-40C7-B601-36E153D4C884}\MpKsl934b1ef3.sys [?]
S1 MpKsl9b5f89b7;MpKsl9b5f89b7;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{325DA6A0-B1FE-471E-B7DA-0F478A0B7C8E}\MpKsl9b5f89b7.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{325DA6A0-B1FE-471E-B7DA-0F478A0B7C8E}\MpKsl9b5f89b7.sys [?]
S1 MpKsla4981242;MpKsla4981242;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9944B66F-B3B2-4034-B922-46CEFCBF7580}\MpKsla4981242.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9944B66F-B3B2-4034-B922-46CEFCBF7580}\MpKsla4981242.sys [?]
S1 MpKsla79f1fd7;MpKsla79f1fd7;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{14CBA0B7-D57B-44F2-8B0C-0FCDBDA600C3}\MpKsla79f1fd7.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{14CBA0B7-D57B-44F2-8B0C-0FCDBDA600C3}\MpKsla79f1fd7.sys [?]
S1 MpKslacb04c91;MpKslacb04c91;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1B3B18FD-7DB3-47D9-8150-FBF34E083880}\MpKslacb04c91.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1B3B18FD-7DB3-47D9-8150-FBF34E083880}\MpKslacb04c91.sys [?]
S1 MpKslc07db79c;MpKslc07db79c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55A4A94B-8293-452E-A87F-8F100CE7F3B5}\MpKslc07db79c.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55A4A94B-8293-452E-A87F-8F100CE7F3B5}\MpKslc07db79c.sys [?]
S1 MpKslc22e3731;MpKslc22e3731;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D605B8F5-9E19-4F54-AD06-78B7D1176008}\MpKslc22e3731.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D605B8F5-9E19-4F54-AD06-78B7D1176008}\MpKslc22e3731.sys [?]
S1 MpKslc6c34cca;MpKslc6c34cca;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{503FFE99-9EC1-4137-88B3-293302CFDD76}\MpKslc6c34cca.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{503FFE99-9EC1-4137-88B3-293302CFDD76}\MpKslc6c34cca.sys [?]
S1 MpKslce0fb214;MpKslce0fb214;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0A238AEC-B20D-48A5-9640-4D54C15AFA65}\MpKslce0fb214.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0A238AEC-B20D-48A5-9640-4D54C15AFA65}\MpKslce0fb214.sys [?]
S1 MpKsld0b39f16;MpKsld0b39f16;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9B846FB-F84F-4471-A0DB-162F22B7E43C}\MpKsld0b39f16.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9B846FB-F84F-4471-A0DB-162F22B7E43C}\MpKsld0b39f16.sys [?]
S1 MpKsld404af1f;MpKsld404af1f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DF48048F-B1A5-43A9-A22B-77F29B747070}\MpKsld404af1f.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DF48048F-B1A5-43A9-A22B-77F29B747070}\MpKsld404af1f.sys [?]
S1 MpKsld6c938b5;MpKsld6c938b5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EAB585D-B6EF-43EA-8CEE-7E4FEAAFD767}\MpKsld6c938b5.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EAB585D-B6EF-43EA-8CEE-7E4FEAAFD767}\MpKsld6c938b5.sys [?]
S1 MpKslda6ad503;MpKslda6ad503;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8B8C44DA-B691-4437-B49E-FF42C49BFC61}\MpKslda6ad503.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8B8C44DA-B691-4437-B49E-FF42C49BFC61}\MpKslda6ad503.sys [?]
S1 MpKsle6b36ab5;MpKsle6b36ab5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D9B848C5-604E-417B-8D8F-021DB62B26D3}\MpKsle6b36ab5.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D9B848C5-604E-417B-8D8F-021DB62B26D3}\MpKsle6b36ab5.sys [?]
S1 MpKsle801b08f;MpKsle801b08f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{29D7E432-4568-46EB-879A-838E187CB137}\MpKsle801b08f.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{29D7E432-4568-46EB-879A-838E187CB137}\MpKsle801b08f.sys [?]
S1 MpKsle94871fb;MpKsle94871fb;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C6AE095C-5082-4401-93AC-6B2AEED74157}\MpKsle94871fb.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C6AE095C-5082-4401-93AC-6B2AEED74157}\MpKsle94871fb.sys [?]
S1 MpKslfcebdd89;MpKslfcebdd89;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D7F44786-ACB6-466E-B6E3-635A046C64DB}\MpKslfcebdd89.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D7F44786-ACB6-466E-B6E3-635A046C64DB}\MpKslfcebdd89.sys [?]
S1 MpKslfdb183f8;MpKslfdb183f8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4263EA77-166E-4BA4-9F86-AE5A77D29F49}\MpKslfdb183f8.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4263EA77-166E-4BA4-9F86-AE5A77D29F49}\MpKslfdb183f8.sys [?]
S1 MpKslfe3bbf65;MpKslfe3bbf65;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{19C4195A-827B-415B-8CB6-3915B64FD4B0}\MpKslfe3bbf65.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{19C4195A-827B-415B-8CB6-3915B64FD4B0}\MpKslfe3bbf65.sys [?]
S1 MpKslfeba29d1;MpKslfeba29d1;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CB63FF0E-C896-4DE7-BBEB-58D96A96DB90}\MpKslfeba29d1.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CB63FF0E-C896-4DE7-BBEB-58D96A96DB90}\MpKslfeba29d1.sys [?]
S3 brfilt;Brother MFC Filter Driver;c:\windows\system32\drivers\BrFilt.sys [1/31/2010 4:37 PM 2944]
S3 brparimg;Brother Multi Function Parallel Image driver;c:\windows\system32\drivers\BrParImg.sys [9/5/2010 2:30 PM 3168]
S3 BrParWdm;Brother WDM Parallel Driver;c:\windows\system32\drivers\BrParwdm.sys [9/5/2010 2:29 PM 39552]
S3 BrSerWDM;Brother WDM Serial driver;c:\windows\system32\drivers\BrSerWdm.sys [1/31/2010 4:37 PM 60416]
S3 BrUsbMdm;Brother MFC USB Fax Only Modem;c:\windows\system32\drivers\BrUsbMdm.sys [1/31/2010 4:37 PM 11008]
S3 BrUsbScn;Brother MFC USB Scanner driver;c:\windows\system32\drivers\BrUsbScn.sys [1/31/2010 4:37 PM 10368]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [6/12/2011 10:15 AM 31125880]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 8:37 PM 4640000]
S3 SaiH0255;SaiH0255;c:\windows\system32\drivers\SaiH0255.sys [5/1/2007 3:11 PM 132232]
S3 SaiHFF12;SaiHFF12;c:\windows\system32\drivers\SaiHFF12.sys [5/1/2007 2:34 PM 132232]
S3 SaiIFF12;Immersion's HID USB Driver (FF12);c:\windows\system32\drivers\SaiIFF12.sys [5/1/2007 2:34 PM 16256]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [8/22/2011 3:55 PM 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [8/22/2011 3:55 PM 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [8/22/2011 3:55 PM 136808]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/30/2010 12:46 PM 136176]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [8/30/2010 12:46 PM 136176]
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-30 17:46]
.
2012-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-30 17:46]
.
2012-01-08 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
2012-01-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1844237615-1409082233-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-10-20 22:32]
.
2012-01-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1844237615-1409082233-725345543-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-10-20 22:32]
.
2012-01-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1844237615-1409082233-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-10-20 22:32]
.
2012-01-06 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1844237615-1409082233-725345543-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-10-20 22:32]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Se&nd; to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Thunder\Application Data\Mozilla\Firefox\Profiles\4ddqcgf1.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - file:///C:/Documents%20and%20Settings/Thunder/Desktop/bookmarks.html
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei;=utf-8&type;=937811&p;=
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Terminator Dongle5.0 - c:\windows\iun6002.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-08 12:23
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(1176)
c:\windows\system32\WININET.dll
c:\windows\system32\nview.dll
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~3\Office14\1033\GrooveIntlResource.dll
c:\windows\system32\ieframe.dll
c:\program files\Iconoid\tr3dll.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\program files\Java\jre6\bin\jqs.exe
e:\program files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2012-01-08 12:30:29 - machine was rebooted
ComboFix-quarantined-files.txt 2012-01-08 17:30
ComboFix2.txt 2012-01-08 05:14
.
Pre-Run: 6,494,932,992 bytes free
Post-Run: 6,521,585,664 bytes free
.
- - End Of File - - 3587D544CD0A75FA2E8DC9464EB46886